Announcing Binius64

The Binius proving stack is about to get much simpler.

Today we are releasing the next evolution of the Binius project: Binius64. This release is part of Irreducible's strategic shift towards client-side proving for digital privacy. Binius64 is a new proof system that distills the best ideas from Binius and optimizes for simplicity and CPU performance.

In this post, we cover the learnings from Binius V0 that went into Binius64, what makes Binius64 unique, its performance on example applications, and the road ahead for Binius.

The Journey

Binius began as an implementation of Irreducible's research into binary tower fields and polynomial commitments, first introduced in this paper. The core innovation was a polynomial commitment scheme that leveraged binary tower fields and the sumcheck protocol to reduce the overhead of embedding small data types into large binary fields.

Binius was born of two observations. First, proving classical hash functions like SHA2 and SHA3 are the main bottleneck in most ZKPs, since arithmetizing bitwise operations (like XOR) incurs an embedding overhead. Second binary tower field arithmetic is far cheaper in hardware than prime field arithmetic.

We built the first version of Binius to be a flexible toolkit for creating verifiable VMs, inspired heavily by Plonky3. Its table-based arithmetization allows for custom constraints, leading to highly scalable proofs at the expense of larger proof sizes. To handle non-trivial statements succinctly, Binius used the M3 arithmetization. We designed that version with custom hardware in mind, while CPU performance took a back seat.

As development progressed, we kept innovating. We invented an even better polynomial commitment scheme, FRI-Binius, applied the GKR protocol for efficiently checking integer multiplications, and incorporated a new technique for constraint verification over small fields. Each new technique advanced the state of the art, but also added complexity. Achieving competitive CPU performance required elaborate workarounds like field isomorphisms and transposed memory layouts. And the flexibility of V0 made recursion difficult and limited our ability to produce private zk-SNARKs rather than just SNARKs. Elegantly integrating all of our learnings required a rethink from first principles.

Introducing Binius64

Today we are excited to introduce Binius64. Binius64 speaks the language of ZK circuits directly, avoiding the overhead of instruction emulation that ZKVMs incur. Instead of arithmetizing over exotic finite fields, Binius64 natively computes over 64-bit words, with built-in constraints for bitwise XOR, bitwise AND, and bit shifts. It also introduces a dedicated constraint for 64-bit unsigned integer multiplication, which is costly to emulate with bitwise gates. On top of these primitives, Binius64 ships with a rich library of useful circuit components: integer operations, multiplexers, hash functions, big numbers, and more.

Here’s a summary of the differences from Binius V0:

We believe this approach is secure, portable, and practical for a wide range of use cases, including anonymous credentials and private payment systems. Of course, it is post-quantum secure and achieves great proof sizes for a hash-based SNARK, even without recursion. Binius64 is the best solution for fast client-side proving on everyday hardware, with a friendly and intuitive developer API.

Performance Results

We've already developed several applications that show how much Binius64 can do. Below we show the performance results for two different types of signature aggregation, one of the pain points of modern blockchain technology. Signature aggregation is crucial for efficient proof-of-stake consensus, as it reduces bandwidth and enables fast light clients and cheap bridging. Moreover, signature verification shows up in other important ZK use cases, such as identity credentials and private payments.

ECDSA-based signature aggregation: We benchmark the ethsign example and chose to compare Binius64 CPU performance against SP1 (Succinct Labs) and R0VM (RiscZero) zkVMs running with the GPU acceleration.

Note: ST/MT refer to single- and multi-threaded operation, respectively.

Results indicate that both Intel (x86) and Graviton (aarch64) CPUs, performing single-core operation, outperform both SP1 and R0VM running on NVIDIA L40S GPUs by ~5x.

Hash-based signature aggregation: We benchmarked XMSS aggregation example, since it has emerged as a top contender for Ethereum’s future post-quantum consensus algorithm. The following results show how Binius64 compares against SP1 and R0VM zkVMs.

Note: Irreducible developed Rust code for the benchmarks running on these zkVMs.

Hash-based signature aggregation highlights even further Binius64’s performance. Multi-threaded Intel (x86) and Graviton (aarch64) CPU operations outperform both SP1 and R0VM running on NVIDIA L40S GPUs by 80-100x.

A significant portion of the performance gains could be attributed to the advantage of the custom-circuits approach compared to general-purpose VMs. This is a fundamental advantage of a ZK-arithmetization-compatible, low-level approach compared to an emulated, high-level VM. While the custom-circuit approach is considered cumbersome and outdated, Binius64 reinvents this. Our native gate set makes arithmetization straightforward, and the API for the custom-circuits is designed with the DevEx in mind, narrowing the gap compared to the VM development.

Check out our Binius64 Benchmark pages for more performance information: you will see various hasher comparisons against Plonky3 and Stwo.

The Path Ahead

As we release Binius64, we are also officially sunsetting Binius V0 and archiving that repo.

We are also releasing Binius64 early, while planning to add several important features by the end of 2025:

• Zero knowledge - This feature is our top-priority. Binius64 does not guarantee the input privacy yet. Adding this feature will enable a set of privacy-preserving applications. We are looking forward to enabling identity credentials, private payments and other zero-knowledge applications built on Binius64.

• Succinctness - While Binius64 proof size is succinct, the verification complexity is not. We are working on achieving succinct verifier complexity and reducing verification times.

• Proof composition - Proof composition and recursion are important techniques for proving large statements, while bounding memory usage.

• Field-native hash functions - We are working on proving a higher throughput of hash functions, by using a field-native hash construction like Vision.

• Easier developer experience - We are working on even better ways to program Binius applications with native Rust code.

• Faster 32-bit operations - By adding more shift variants for 32-bit values, we will improve performance for hash functions like SHA-256 and Blake3.

We’re excited to see what applications the community will build with Binius64. To get started, head over to the Binius documentation site, for an easy-to-follow developer guide and comprehensive documentation on the cryptographic protocol. Or jump straight into the code on GitHub and run the examples for yourself! We’re going to keep the updates coming, so make sure to follow our GitHub repo and X account!